Artificial intelligence is transforming cybersecurity — but cybercriminals are using the same technology to make attacks faster, more convincing and easier to scale.
According to Kaspersky data, 43% of organisations believe cybercriminals are using AI to increase the effectiveness of their attacks, while 21% believe attackers are already ahead in the technology race.
The growing AI arms race is forcing businesses to rethink their cybersecurity strategies, with isolated security tools increasingly giving way to integrated, AI-powered platforms.
Cybercriminals are weaponising AI
Attackers are using generative AI across multiple stages of the cyberattack process, from creating convincing phishing messages and social-engineering campaigns to developing malware and improving its ability to evade detection.
Kaspersky’s investigation into the RevengeHotels campaign, which targeted hospitality businesses in Latin America, found evidence of AI-generated code being incorporated into malware development and delivery.
The financial sector is facing similar risks, with AI being used to create more targeted fraud and social-engineering attacks, while the entertainment industry is dealing with threats including deepfakes, content fraud and AI-assisted attacks on digital infrastructure.
The biggest advantage for criminals is speed and scale. AI can dramatically reduce the time and expertise needed to identify targets, create malicious content and adapt attacks.
AI becomes a cybersecurity weapon
Security companies are responding by embedding AI throughout the detection and response process.
AI can help security teams identify unusual login behaviour, assess risks across an organisation’s infrastructure and automatically highlight potentially compromised assets.
It can also summarise incidents, identify how an attack began and explain an attacker’s actions in plain language. AI-powered assistants can further help analysts interpret suspicious commands and generate investigation reports.
For security operations centres facing staff shortages and overwhelming volumes of alerts, these capabilities can reduce the manual workload and allow analysts to focus on the threats that matter most.
The challenges of adopting AI
However, introducing AI into cybersecurity is not as simple as adding another tool.
Organisations need high-quality data and broad telemetry coverage across endpoints, identity systems, cloud environments and networks. Fragmented data can limit the effectiveness of AI-driven detection.
Integration and costs are another concern. Adding AI capabilities to already fragmented security stacks can increase complexity rather than reduce it.
There are also skills and governance challenges. AI systems need to fit naturally into existing security workflows while organisations establish clear rules around transparency, human oversight and responsible use.
Building a smarter security strategy
For businesses, the question is no longer whether AI belongs in cybersecurity, but how to use it effectively.
Experts recommend consolidating security data, prioritising platforms where AI is integrated rather than bolted on, measuring the technology’s impact on analyst workloads and introducing AI through phased deployments.
As attackers become more sophisticated, organisations cannot afford to treat AI as an optional add-on.
The next phase of cybersecurity will be an AI arms race — and businesses need intelligent, integrated defences to keep pace.
Main Image: Intercede
